LEGAL

Privacy Policy.

Last updated: 4 May 2026

This policy explains what personal data we collect when you use avilys.co, why we collect it, and what your rights are. We’ve kept it as plain-language as the law allows.

01

About this policy.

This Privacy Policy explains how Avilys Marketing Pte Ltd (“Avilys”, “we”, “us”, or “our”) collects, uses, and protects personal data when you visit avilys.co, fill in a form, subscribe to our newsletter, download a resource, book a call, or otherwise interact with us through this website.

We’re a Singapore-based outsourced marketing agency, registered at 18 Boon Lay Way #07-120, Tradehub21, Singapore 609966 (UEN 202408674N). Avilys Marketing Pte Ltd is a subsidiary of Unshakeable Group Pte Ltd, but operates independently — we don’t share systems or data with our parent company or any other group entity.

Avilys Academy is a separate product line operated under the same legal entity, but it runs on a different website (avilysacademy.com) with its own privacy practices. This policy covers avilys.co only.

We follow Singapore’s Personal Data Protection Act 2012 (PDPA). If you’re based in the EU or UK, the relevant parts of the General Data Protection Regulation (GDPR) also apply, and we’ve written this policy to honour both.

02

What we collect.

Information you give us directly

When you fill in a form, book a call, subscribe to our newsletter, or download a free resource on our site, we collect what you submit. That typically includes:

• Your name
• Your email address
• Your phone number (where requested)
• Your company name, role, and business details
• Information about your marketing situation and what you’re looking for help with

Information we collect automatically

When you visit avilys.co, our hosting and analytics tools log:

• Your IP address
• Browser type and operating system
• The pages you visit, time on page, and how you got to the site
• Approximate location (derived from IP, usually accurate to city level)
• Standard server logs (request timestamps, error logs)

Information from third parties

If you reach us through a referral, an introduction, or a partner link, we may receive your contact details from that source.

What we don’t collect

We don’t collect special category data (health, race, political opinions, religion, sexual orientation, etc.). avilys.co isn’t aimed at children, and we don’t knowingly collect data from anyone under 16.

03

How we collect it.

We collect personal data through:

• Forms on our site — built using Typeform and WPForms. The contact form, the HIVE Engine diagnostic, and lead magnet downloads run through these platforms.
• Newsletter subscriptions — handled by ActiveCampaign.
• Booking calls — handled by Calendly.
• Ivy — our in-house onboarding and diagnostic tool, which collects business information so we can assess fit and prepare for engagements. Ivy runs on Netlify and uses Anthropic’s Claude API for its conversational logic.
• Cookies and tracking technologies — see Section 09.
• Direct contact — when you email us, message us on social, or get in touch any other way.

04

Why we collect it and our lawful basis.

We use personal data for specific, limited purposes. Under PDPA, we rely on either your consent or a legitimate interest. Under GDPR, each purpose has a corresponding lawful basis. The main purposes are:

• Responding to your enquiries — if you contact us, we use your data to reply and follow up. (Lawful basis: contract / pre-contract steps, or consent.)
• Sending you the newsletter and resources you’ve requested — you’ve opted in. (Lawful basis: consent.)
• Marketing communications — sending occasional marketing emails to people who’ve subscribed or who we have a legitimate interest in reaching (existing contacts, prospects). You can unsubscribe at any time. (Lawful basis: consent or legitimate interest.)
• Running and improving the website — analytics, security, and performance. (Lawful basis: legitimate interest.)
• Assessing fit for our services — through Ivy and our diagnostic forms, so we can decide whether and how to engage. (Lawful basis: legitimate interest, with consent for any sensitive details.)
• Legal and regulatory compliance — tax, accounting, dispute resolution. (Lawful basis: legal obligation.)

05

Who we share it with.

We don’t sell your personal data. We share it only where necessary to operate the business, and only with parties that meet appropriate data protection standards.

Service providers we use

The third-party platforms that process your data on our behalf include:

• SiteGround — website hosting (Singapore data centre)
• Typeform and WPForms — form collection
• ActiveCampaign — email marketing and CRM
• Calendly — meeting scheduling
• Google Analytics 4 — website analytics
• Meta (Facebook/Instagram) — advertising and pixel tracking
• Google Ads — advertising and conversion tracking
• Netlify — hosting for Ivy and our serverless tools
• Anthropic — the AI provider powering Ivy’s conversational logic

Each of these platforms has their own privacy practices, which we encourage you to review.

Other circumstances

Authorities. If we’re legally required to disclose data (court order, regulatory request).

A future buyer. If Avilys Marketing Pte Ltd is ever sold, merged, or restructured, your data may transfer to the acquiring entity. We’d notify you, and this policy would continue to apply.

We don’t share your data with Unshakeable Group Pte Ltd or any other group entity.

06

International data transfers.

Most of our service providers store data outside Singapore — typically in the US (ActiveCampaign, Calendly, Google, Meta, Netlify, Anthropic) or the EU (Typeform, in Spain). Our hosting provider (SiteGround) keeps data in Singapore.

When we transfer your data outside Singapore, we make sure the recipient provides a comparable standard of protection — either through their own compliance with PDPA-equivalent regimes, contractual safeguards, or recognised transfer mechanisms (Standard Contractual Clauses for EU/UK transfers).

07

How long we keep it.

We keep personal data only as long as we need it, plus any period the law requires.

When data is no longer needed, we delete it or anonymise it.

08

Your rights.

Under PDPA and GDPR, you have the right to:

• Access — ask us what personal data we hold about you
• Correct — ask us to update inaccurate data
• Withdraw consent — for anything you’ve consented to (newsletter, marketing)
• Erase — ask us to delete your data, subject to any retention obligations we have under law
• Object — to specific uses, including direct marketing
• Portability (GDPR only) — receive your data in a portable format
• Restrict processing (GDPR only) — limit how we use your data
• Complain — to the Personal Data Protection Commission of Singapore (PDPC) if you’re in Singapore, or your local supervisory authority if you’re in the EU or UK

09

Cookies.

avilys.co uses cookies and similar technologies for four purposes:

• Strictly necessary — running the site and keeping it secure (these can’t be turned off)
• Functional — remembering your preferences
• Analytics — understanding how the site is used (GA4)
• Advertising — showing relevant ads on Meta and Google to people who’ve visited the site (Meta Pixel, Google Ads conversion tag)

You can accept, reject, or customise your cookie preferences through the cookie banner on first visit, and update your choices any time via the cookie settings link in our footer.

For the full breakdown of every cookie we set — including names, purposes, and durations — see our Cookie Policy.

10

Children’s data.

avilys.co is intended for business audiences and isn’t directed at children. We don’t knowingly collect personal data from anyone under 16. If you believe we’ve inadvertently collected data from a child, please get in touch through our contact page and we’ll delete it promptly.

11

Security.

We take reasonable technical and organisational measures to protect personal data, including:

• HTTPS encryption across the entire website
• Access controls limiting who on our team can see what data
• Vetting service providers for their own security practices
• Regular software updates and security patches
• Backup and recovery procedures for data we control

That said, no system is perfectly secure, and we can’t guarantee absolute protection. If we ever experience a data breach affecting your personal data, we’ll notify you and the relevant authorities as required by law.

12

Changes to this policy.

We may update this policy from time to time to reflect changes in our practices, our services, or the law. When we do, we’ll update the “Last updated” date at the top of this page.

For material changes, we’ll notify subscribers by email or post a notice on the site. Your continued use of the website after changes take effect constitutes acceptance of the updated policy.

13

Contact us.

For any questions about this Privacy Policy, your personal data, or to exercise any of your rights, please get in touch through our contact page. Select “Press / media enquiry” or “Something else” and mention “privacy” in your message so we can route it correctly.

If you’re not satisfied with our response, you can lodge a complaint with the Personal Data Protection Commission of Singapore (pdpc.gov.sg) or, if you’re based in the EU or UK, your local data protection authority.